In the documentation it says i should call raise DropMatchException() when i want to ignore a match.
So i wrote the following code to drop matches that occurs between 02:30 - 02:45 and 14:30 - 14:45 with the following.
drop_if_in_maintenance_window.py
from elastalert.enhancements import BaseEnhancement
import datetime
import time
def datetime_from_utc_to_local(utc_datetime):
now_timestamp = time.time()
offset = datetime.datetime.fromtimestamp(now_timestamp) - datetime.datetime.utcfromtimestamp(now_timestamp)
return utc_datetime + offset
class DropIfInMaintenanceWindow(BaseEnhancement):
def process(self, match):
dateformat = "%Y-%m-%dT%H:%M:%S"
timestamp = datetime.datetime.strptime(match['@timestamp'][:-5], dateformat)
timestamp = datetime_from_utc_to_local(timestamp)
timePart = timestamp.time()
if timePart >= datetime.time(2, 30) and timePart <= datetime.time(2, 45):
raise DropMatchException()
elif timePart >= datetime.time(14, 30) and timePart <= datetime.time(14, 45):
raise DropMatchException()
but this yields the following error
The rule cpu_alert has raised an uncaught exception.
It has been disabled and will be re-enabled when ElastAlert restarts or if the rule config file has been modified.
Traceback (most recent call last):
File "/etc/elastalert/elastalert/elastalert.py", line 928, in alert
return self.send_alert(matches, rule, alert_time=alert_time)
File "/etc/elastalert/elastalert/elastalert.py", line 980, in send_alert
enhancement.process(match)
File "elastalert_modules/drop_if_in_maintenance_window.py", line 21, in process
raise DropMatchException()
NameError: global name 'DropMatchException' is not defined.
What am i missing?
- from elastalert.enhancements import BaseEnhancement
+ from elastalert.enhancements import BaseEnhancement, DropMatchException
@Qmando Thanks!
Most helpful comment